Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days

Contributed by Merill FernandoAll contributors →

Part of DISA · Intune · Tenant administration · All checks

Run this check

Invoke-Maester -TestId DISA.V-273868

Overview

An Intune diagnostic setting sends the Intune audit logs to a log store outside Intune. (DISA Microsoft Intune MDM Service Desktop and Mobile STIG, V-273868, CAT II).

Intune keeps its audit logs for a limited time and only in the Intune admin center. Sending them to Azure Monitor or a SIEM keeps them and lets the security team review and alert on changes.

The STIG accepts a third-party log server or Azure Monitor. This test runs MT.1100, which checks that an Intune diagnostic setting includes the audit logs; logs sent another way must be checked by hand.

Remediation action

1. In the Microsoft Intune admin center, go to Reports > Diagnostic settings.
2. Select Add diagnostic setting.
3. Select the AuditLogs category (and any other Intune logs you need) and send them to a Log Analytics workspace, a storage account, an event hub or a partner solution.
4. Select Save.

Related links

• DISA Microsoft Intune MDM Service Desktop and Mobile STIG: V-273868
• Send Intune log data to storage, event hubs, or Log Analytics

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-273868
Severity	High
Suite	DISA
Product	Intune
Feature	Tenant administration
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	DISA Microsoft Intune MDM Service Desktop and Mobile STIG (version V1R2), requirement V-273868
Supports controls	disa-stig-intune-mdm:V-273868, nist-800-53-r5:AU-4(1), nist-800-53-r5:AU-9(2)
PowerShell test	Test-MtDisaIntuneLogExport
Services	Azure
Compatible licenses	INTUNE_A

Source

• Test: tests/disa/Test.DISA.V-273868.ps1
• Documentation: tests/disa/Test.DISA.V-273868.md